@intutic/shared-types 2.3.0 → 2.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +106 -0
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +17 -1
- package/dist/auth.js.map +1 -1
- package/dist/cloudProbe.d.ts +54 -0
- package/dist/cloudProbe.d.ts.map +1 -0
- package/dist/cloudProbe.js +254 -0
- package/dist/cloudProbe.js.map +1 -0
- package/dist/enums.d.ts +48 -0
- package/dist/enums.d.ts.map +1 -1
- package/dist/enums.js +31 -3
- package/dist/enums.js.map +1 -1
- package/dist/finops.d.ts +38 -0
- package/dist/finops.d.ts.map +1 -1
- package/dist/guardrailIr.d.ts +6 -6
- package/dist/index.d.ts +9 -4
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +35 -6
- package/dist/index.js.map +1 -1
- package/dist/mcpBudgets.d.ts +24 -24
- package/dist/notifications.d.ts +17 -2
- package/dist/notifications.d.ts.map +1 -1
- package/dist/notifications.js +26 -1
- package/dist/notifications.js.map +1 -1
- package/dist/providerVerification.d.ts +35 -9
- package/dist/providerVerification.d.ts.map +1 -1
- package/dist/providerVerification.js +79 -19
- package/dist/providerVerification.js.map +1 -1
- package/dist/providers.d.ts +50 -13
- package/dist/providers.d.ts.map +1 -1
- package/dist/providers.js +131 -27
- package/dist/providers.js.map +1 -1
- package/dist/spendBudgets.d.ts +122 -0
- package/dist/spendBudgets.d.ts.map +1 -0
- package/dist/spendBudgets.js +92 -0
- package/dist/spendBudgets.js.map +1 -0
- package/dist/upstreamRetry.d.ts +121 -0
- package/dist/upstreamRetry.d.ts.map +1 -0
- package/dist/upstreamRetry.js +90 -0
- package/dist/upstreamRetry.js.map +1 -0
- package/dist/wasmRuleDescriptor.d.ts +43 -0
- package/dist/wasmRuleDescriptor.d.ts.map +1 -0
- package/dist/wasmRuleDescriptor.js +65 -0
- package/dist/wasmRuleDescriptor.js.map +1 -0
- package/dist/workspaceSettings.d.ts +37 -0
- package/dist/workspaceSettings.d.ts.map +1 -1
- package/dist/workspaceSettings.js.map +1 -1
- package/package.json +2 -2
package/dist/notifications.d.ts
CHANGED
|
@@ -4,7 +4,7 @@ export type NotificationChannel = 'slack' | 'email' | 'webhook' | 'pagerduty';
|
|
|
4
4
|
* naming anything else, and the CLI and the Terraform provider check
|
|
5
5
|
* against this list before they send one.
|
|
6
6
|
*/
|
|
7
|
-
export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "adapter.write_back.failed", "decision.pending", "decision.approved", "decision.rejected", "ssl.enforcement.violation", "context_gap.auto_injected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
|
|
7
|
+
export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "adapter.write_back.failed", "decision.pending", "decision.approved", "decision.rejected", "ssl.enforcement.violation", "context_gap.auto_injected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "credential.changed", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
|
|
8
8
|
export type NotificationEventType = (typeof NOTIFICATION_EVENT_TYPES)[number];
|
|
9
9
|
export type NotificationStatus = 'sent' | 'failed' | 'deduplicated' | 'filtered';
|
|
10
10
|
export interface NotificationRule {
|
|
@@ -75,15 +75,30 @@ export interface NotificationLogEntry {
|
|
|
75
75
|
latencyMs: number | null;
|
|
76
76
|
createdAt: string;
|
|
77
77
|
}
|
|
78
|
+
/** The severity a notification is sent at, which a rule's severity filter matches on. */
|
|
79
|
+
export type NotificationSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
|
|
78
80
|
export interface GovernanceEvent {
|
|
79
81
|
type: NotificationEventType;
|
|
80
82
|
workspaceId: string;
|
|
81
83
|
sessionId?: string;
|
|
82
|
-
severity:
|
|
84
|
+
severity: NotificationSeverity;
|
|
83
85
|
summary: string;
|
|
84
86
|
description: string;
|
|
85
87
|
metadata: Record<string, unknown>;
|
|
86
88
|
}
|
|
89
|
+
/**
|
|
90
|
+
* The severity `incident.created` is sent at, from the incident's own
|
|
91
|
+
* (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
|
|
92
|
+
* CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
|
|
93
|
+
* MEDIUM incident and a rule filtered on HIGH received none.
|
|
94
|
+
*/
|
|
95
|
+
export declare const INCIDENT_NOTIFICATION_SEVERITY: Readonly<Record<'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW', NotificationSeverity>>;
|
|
96
|
+
/**
|
|
97
|
+
* {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
|
|
98
|
+
* One the map does not name (absent, or from an emitter that sent something
|
|
99
|
+
* else) is sent at CRITICAL: a malformed event must not quieten an alert.
|
|
100
|
+
*/
|
|
101
|
+
export declare function incidentNotificationSeverity(severity: unknown): NotificationSeverity;
|
|
87
102
|
export interface DispatchResult {
|
|
88
103
|
ruleId: string;
|
|
89
104
|
channel: NotificationChannel;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB
|
|
1
|
+
{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,qoDA2O3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,oBAAoB,CAAC,CAKzH,CAAA;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,CAIpF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}
|
package/dist/notifications.js
CHANGED
|
@@ -3,7 +3,8 @@
|
|
|
3
3
|
// Notification Hub + Slack Adapter
|
|
4
4
|
// ============================================
|
|
5
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
-
exports.NOTIFICATION_EVENT_TYPES = void 0;
|
|
6
|
+
exports.INCIDENT_NOTIFICATION_SEVERITY = exports.NOTIFICATION_EVENT_TYPES = void 0;
|
|
7
|
+
exports.incidentNotificationSeverity = incidentNotificationSeverity;
|
|
7
8
|
/**
|
|
8
9
|
* Every event a notification rule can subscribe to. The API refuses a rule
|
|
9
10
|
* naming anything else, and the CLI and the Terraform provider check
|
|
@@ -97,6 +98,8 @@ exports.NOTIFICATION_EVENT_TYPES = [
|
|
|
97
98
|
'webhook.secret.rotated',
|
|
98
99
|
/** A member downloaded compliance evidence: a SOC 2 archive, a framework coverage report file or the human-oversight export. The `evidence_exports` row. */
|
|
99
100
|
'evidence.exported',
|
|
101
|
+
/** An API key, gateway token or SCIM token was created, rotated or revoked, or a provider credential was provisioned, replaced or removed. The `credential_changes` row: `credential_type`, `credential_id`, `action` and who; never the value. */
|
|
102
|
+
'credential.changed',
|
|
100
103
|
// ── Workspace context ──
|
|
101
104
|
'workspace.context.updated',
|
|
102
105
|
// ── Self-hosted gateway ──
|
|
@@ -243,4 +246,26 @@ exports.NOTIFICATION_EVENT_TYPES = [
|
|
|
243
246
|
*/
|
|
244
247
|
'skill.semantic.flagged',
|
|
245
248
|
];
|
|
249
|
+
/**
|
|
250
|
+
* The severity `incident.created` is sent at, from the incident's own
|
|
251
|
+
* (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
|
|
252
|
+
* CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
|
|
253
|
+
* MEDIUM incident and a rule filtered on HIGH received none.
|
|
254
|
+
*/
|
|
255
|
+
exports.INCIDENT_NOTIFICATION_SEVERITY = {
|
|
256
|
+
CRITICAL: 'CRITICAL',
|
|
257
|
+
HIGH: 'HIGH',
|
|
258
|
+
MEDIUM: 'MEDIUM',
|
|
259
|
+
LOW: 'LOW',
|
|
260
|
+
};
|
|
261
|
+
/**
|
|
262
|
+
* {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
|
|
263
|
+
* One the map does not name (absent, or from an emitter that sent something
|
|
264
|
+
* else) is sent at CRITICAL: a malformed event must not quieten an alert.
|
|
265
|
+
*/
|
|
266
|
+
function incidentNotificationSeverity(severity) {
|
|
267
|
+
return typeof severity === 'string' && Object.hasOwn(exports.INCIDENT_NOTIFICATION_SEVERITY, severity)
|
|
268
|
+
? exports.INCIDENT_NOTIFICATION_SEVERITY[severity]
|
|
269
|
+
: 'CRITICAL';
|
|
270
|
+
}
|
|
246
271
|
//# sourceMappingURL=notifications.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;
|
|
1
|
+
{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AAqW/C,oEAIC;AAnWD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,2BAA2B;IAC3B,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,2BAA2B;IAC3B,2BAA2B;IAC3B,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,mPAAmP;IACnP,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA;AA6FV;;;;;GAKG;AACU,QAAA,8BAA8B,GAAmF;IAC5H,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,sCAA8B,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,sCAA8B,CAAC,QAAuD,CAAC;QACzF,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}
|
|
@@ -29,8 +29,16 @@ export interface ProviderProbeRequest {
|
|
|
29
29
|
url: string;
|
|
30
30
|
method: 'GET' | 'POST';
|
|
31
31
|
headers: Record<string, string>;
|
|
32
|
-
/** Present only for POST probes (
|
|
32
|
+
/** Present only for POST probes (the cloud token and STS calls). */
|
|
33
33
|
body?: string;
|
|
34
|
+
/** A provider-specific reading of the answer; `classifyProbeResponse` otherwise. */
|
|
35
|
+
classify?: (status: number, headers: {
|
|
36
|
+
get(name: string): string | null;
|
|
37
|
+
}) => ProbeVerdict;
|
|
38
|
+
/** What a `valid` answer proves, when it is narrower than "the credential works". */
|
|
39
|
+
validDetail?: string;
|
|
40
|
+
/** Decided without a request (a key that cannot be used at all); nothing is sent. */
|
|
41
|
+
localVerdict?: ProbeVerdict;
|
|
34
42
|
}
|
|
35
43
|
/**
|
|
36
44
|
* Build the cheapest authenticated request that proves a credential works,
|
|
@@ -38,18 +46,36 @@ export interface ProviderProbeRequest {
|
|
|
38
46
|
*
|
|
39
47
|
* `fields` is the provider's credential field map exactly as stored — the
|
|
40
48
|
* same shape `PROVIDER_REGISTRY`'s `ProviderCredentialField.key`s describe
|
|
41
|
-
* (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint
|
|
42
|
-
*
|
|
49
|
+
* (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint }`
|
|
50
|
+
* for Azure OpenAI.
|
|
43
51
|
*
|
|
44
|
-
* Bedrock and Vertex AI return `null
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
*
|
|
49
|
-
* the credential.
|
|
52
|
+
* Bedrock and Vertex AI return `null` here: their probe is signed per
|
|
53
|
+
* request, which takes WebCrypto and is asynchronous — see
|
|
54
|
+
* `buildVerificationProbeAsync`, which every executor calls. A caller seeing
|
|
55
|
+
* `null` from that should say "cannot verify automatically," not fail the
|
|
56
|
+
* credential.
|
|
50
57
|
*/
|
|
51
58
|
export declare function buildVerificationProbe(provider: string, fields: Record<string, string>): ProviderProbeRequest | null;
|
|
52
59
|
export type ProbeVerdict = 'valid' | 'invalid' | 'unknown';
|
|
60
|
+
/**
|
|
61
|
+
* The model ids in a provider's list-models answer (the body a `valid`
|
|
62
|
+
* verification probe got back), deduplicated and sorted; `null` when this
|
|
63
|
+
* provider's probe does not list the models a request can name, or the body
|
|
64
|
+
* is not the expected shape.
|
|
65
|
+
*
|
|
66
|
+
* Azure OpenAI's probe lists base models, while a request names a deployment,
|
|
67
|
+
* so its list would mislead; Bedrock and Vertex AI probe identity, not models.
|
|
68
|
+
*/
|
|
69
|
+
export declare function parseProviderModels(provider: string, body: unknown): string[] | null;
|
|
70
|
+
/**
|
|
71
|
+
* The probe for any provider: a signed cloud probe for Bedrock and Vertex AI
|
|
72
|
+
* (`cloudProbe.ts`), the plain request description otherwise.
|
|
73
|
+
*/
|
|
74
|
+
export declare function buildVerificationProbeAsync(provider: string, fields: Record<string, string>, now?: Date): Promise<ProviderProbeRequest | null>;
|
|
75
|
+
/** The verdict for a probe's answer: the probe's own reading when it has one. */
|
|
76
|
+
export declare function classifyProbe(probe: ProviderProbeRequest, status: number, headers?: {
|
|
77
|
+
get(name: string): string | null;
|
|
78
|
+
}): ProbeVerdict;
|
|
53
79
|
/**
|
|
54
80
|
* Classify a probe's HTTP response. Deliberately narrow about what counts as
|
|
55
81
|
* "invalid": only 401/403 mean the credential itself is wrong. A 429
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;
|
|
1
|
+
{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmBH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,YAAY,CAAA;IAC1F,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,oBAAoB,GAAG,IAAI,CA6G7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAe1D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAuBpF;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7C,YAAY,CAId;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAItE"}
|
|
@@ -28,7 +28,11 @@
|
|
|
28
28
|
*/
|
|
29
29
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
30
30
|
exports.buildVerificationProbe = buildVerificationProbe;
|
|
31
|
+
exports.parseProviderModels = parseProviderModels;
|
|
32
|
+
exports.buildVerificationProbeAsync = buildVerificationProbeAsync;
|
|
33
|
+
exports.classifyProbe = classifyProbe;
|
|
31
34
|
exports.classifyProbeResponse = classifyProbeResponse;
|
|
35
|
+
const cloudProbe_js_1 = require("./cloudProbe.js");
|
|
32
36
|
/**
|
|
33
37
|
* Strip trailing `/` characters, without a regex. `endpoint`/`apiBase` are
|
|
34
38
|
* workspace-provisioned credential fields — CodeQL correctly flagged the
|
|
@@ -50,15 +54,14 @@ function stripTrailingSlashes(s) {
|
|
|
50
54
|
*
|
|
51
55
|
* `fields` is the provider's credential field map exactly as stored — the
|
|
52
56
|
* same shape `PROVIDER_REGISTRY`'s `ProviderCredentialField.key`s describe
|
|
53
|
-
* (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint
|
|
54
|
-
*
|
|
57
|
+
* (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint }`
|
|
58
|
+
* for Azure OpenAI.
|
|
55
59
|
*
|
|
56
|
-
* Bedrock and Vertex AI return `null
|
|
57
|
-
*
|
|
58
|
-
*
|
|
59
|
-
*
|
|
60
|
-
*
|
|
61
|
-
* the credential.
|
|
60
|
+
* Bedrock and Vertex AI return `null` here: their probe is signed per
|
|
61
|
+
* request, which takes WebCrypto and is asynchronous — see
|
|
62
|
+
* `buildVerificationProbeAsync`, which every executor calls. A caller seeing
|
|
63
|
+
* `null` from that should say "cannot verify automatically," not fail the
|
|
64
|
+
* credential.
|
|
62
65
|
*/
|
|
63
66
|
function buildVerificationProbe(provider, fields) {
|
|
64
67
|
switch (provider) {
|
|
@@ -66,21 +69,16 @@ function buildVerificationProbe(provider, fields) {
|
|
|
66
69
|
const apiKey = fields.apiKey;
|
|
67
70
|
if (!apiKey)
|
|
68
71
|
return null;
|
|
69
|
-
//
|
|
70
|
-
//
|
|
72
|
+
// Listing models is the cheapest authenticated call Anthropic has: it
|
|
73
|
+
// spends no tokens, and the answer says which models the key reaches.
|
|
74
|
+
// 1000 is the page-size ceiling, enough for the whole catalog in one call.
|
|
71
75
|
return {
|
|
72
|
-
url: 'https://api.anthropic.com/v1/
|
|
73
|
-
method: '
|
|
76
|
+
url: 'https://api.anthropic.com/v1/models?limit=1000',
|
|
77
|
+
method: 'GET',
|
|
74
78
|
headers: {
|
|
75
79
|
'x-api-key': apiKey,
|
|
76
80
|
'anthropic-version': '2023-06-01',
|
|
77
|
-
'content-type': 'application/json',
|
|
78
81
|
},
|
|
79
|
-
body: JSON.stringify({
|
|
80
|
-
model: 'claude-haiku-4-5',
|
|
81
|
-
max_tokens: 1,
|
|
82
|
-
messages: [{ role: 'user', content: 'hi' }],
|
|
83
|
-
}),
|
|
84
82
|
};
|
|
85
83
|
}
|
|
86
84
|
case 'openai': {
|
|
@@ -138,7 +136,7 @@ function buildVerificationProbe(provider, fields) {
|
|
|
138
136
|
if (!apiKey)
|
|
139
137
|
return null;
|
|
140
138
|
return {
|
|
141
|
-
url: `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(apiKey)}`,
|
|
139
|
+
url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1000&key=${encodeURIComponent(apiKey)}`,
|
|
142
140
|
method: 'GET',
|
|
143
141
|
headers: {},
|
|
144
142
|
};
|
|
@@ -174,6 +172,68 @@ function buildVerificationProbe(provider, fields) {
|
|
|
174
172
|
return null;
|
|
175
173
|
}
|
|
176
174
|
}
|
|
175
|
+
/** `body[listKey][].{idKey}` values that are non-empty strings. */
|
|
176
|
+
function pluck(body, listKey, idKey) {
|
|
177
|
+
if (typeof body !== 'object' || body === null)
|
|
178
|
+
return null;
|
|
179
|
+
const list = body[listKey];
|
|
180
|
+
if (!Array.isArray(list))
|
|
181
|
+
return null;
|
|
182
|
+
const ids = [];
|
|
183
|
+
for (const entry of list) {
|
|
184
|
+
const id = typeof entry === 'object' && entry !== null ? entry[idKey] : undefined;
|
|
185
|
+
if (typeof id === 'string' && id.length > 0)
|
|
186
|
+
ids.push(id);
|
|
187
|
+
}
|
|
188
|
+
return ids;
|
|
189
|
+
}
|
|
190
|
+
/**
|
|
191
|
+
* The model ids in a provider's list-models answer (the body a `valid`
|
|
192
|
+
* verification probe got back), deduplicated and sorted; `null` when this
|
|
193
|
+
* provider's probe does not list the models a request can name, or the body
|
|
194
|
+
* is not the expected shape.
|
|
195
|
+
*
|
|
196
|
+
* Azure OpenAI's probe lists base models, while a request names a deployment,
|
|
197
|
+
* so its list would mislead; Bedrock and Vertex AI probe identity, not models.
|
|
198
|
+
*/
|
|
199
|
+
function parseProviderModels(provider, body) {
|
|
200
|
+
let ids;
|
|
201
|
+
switch (provider) {
|
|
202
|
+
case 'anthropic':
|
|
203
|
+
case 'openai':
|
|
204
|
+
case 'mistral':
|
|
205
|
+
case 'openrouter':
|
|
206
|
+
case 'deepseek':
|
|
207
|
+
ids = pluck(body, 'data', 'id');
|
|
208
|
+
break;
|
|
209
|
+
case 'gemini':
|
|
210
|
+
// Gemini names a model `models/gemini-2.5-pro`; requests use the bare id.
|
|
211
|
+
ids = pluck(body, 'models', 'name')?.map((n) => (n.startsWith('models/') ? n.slice('models/'.length) : n)) ?? null;
|
|
212
|
+
break;
|
|
213
|
+
case 'cohere':
|
|
214
|
+
case 'ollama':
|
|
215
|
+
ids = pluck(body, 'models', 'name');
|
|
216
|
+
break;
|
|
217
|
+
default:
|
|
218
|
+
return null;
|
|
219
|
+
}
|
|
220
|
+
if (!ids)
|
|
221
|
+
return null;
|
|
222
|
+
return [...new Set(ids.filter((id) => id.length > 0))].sort();
|
|
223
|
+
}
|
|
224
|
+
/**
|
|
225
|
+
* The probe for any provider: a signed cloud probe for Bedrock and Vertex AI
|
|
226
|
+
* (`cloudProbe.ts`), the plain request description otherwise.
|
|
227
|
+
*/
|
|
228
|
+
async function buildVerificationProbeAsync(provider, fields, now = new Date()) {
|
|
229
|
+
return (await (0, cloudProbe_js_1.buildCloudVerificationProbe)(provider, fields, now)) ?? buildVerificationProbe(provider, fields);
|
|
230
|
+
}
|
|
231
|
+
/** The verdict for a probe's answer: the probe's own reading when it has one. */
|
|
232
|
+
function classifyProbe(probe, status, headers) {
|
|
233
|
+
return probe.classify
|
|
234
|
+
? probe.classify(status, headers ?? { get: () => null })
|
|
235
|
+
: classifyProbeResponse(status);
|
|
236
|
+
}
|
|
177
237
|
/**
|
|
178
238
|
* Classify a probe's HTTP response. Deliberately narrow about what counts as
|
|
179
239
|
* "invalid": only 401/403 mean the credential itself is wrong. A 429
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"providerVerification.js","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;
|
|
1
|
+
{"version":3,"file":"providerVerification.js","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAgDH,wDAgHC;AA0BD,kDAuBC;AAMD,kEAMC;AAGD,sCAQC;AAYD,sDAIC;AAtPD,mDAA6D;AAE7D;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,sBAAsB,CACpC,QAAgB,EAChB,MAA8B;IAE9B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,sEAAsE;YACtE,sEAAsE;YACtE,2EAA2E;YAC3E,OAAO;gBACL,GAAG,EAAE,gDAAgD;gBACrD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,WAAW,EAAE,MAAM;oBACnB,mBAAmB,EAAE,YAAY;iBAClC;aACF,CAAA;QACH,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,kCAAkC;gBACvC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAA;QACH,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,kCAAkC;gBACvC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAA;QACH,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,qCAAqC;gBAC1C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAA;QACH,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,oCAAoC;gBACzC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAA;QACH,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,kCAAkC;gBACvC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAA;QACH,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO;gBACL,GAAG,EAAE,6EAA6E,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC9G,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE;aACZ,CAAA;QACH,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACpF,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YACrC,OAAO;gBACL,GAAG,EAAE,GAAG,QAAQ,uCAAuC;gBACvD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;aAC/B,CAAA;QACH,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACjF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAA;YACzB,mEAAmE;YACnE,sEAAsE;YACtE,uDAAuD;YACvD,OAAO;gBACL,GAAG,EAAE,GAAG,OAAO,WAAW;gBAC1B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE;aACZ,CAAA;QACH,CAAC;QAED,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,IAAI,CAAA;QAEb;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAID,mEAAmE;AACnE,SAAS,KAAK,CAAC,IAAa,EAAE,OAAe,EAAE,KAAa;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,IAAI,GAAI,IAAgC,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9G,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,IAAa;IACjE,IAAI,GAAoB,CAAA;IACxB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU;YACb,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YAC/B,MAAK;QACP,KAAK,QAAQ;YACX,0EAA0E;YAC1E,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;YAClH,MAAK;QACP,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YACnC,MAAK;QACP;YACE,OAAO,IAAI,CAAA;IACf,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAC/D,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,MAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;IAEtB,OAAO,CAAC,MAAM,IAAA,2CAA2B,EAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;AAC/G,CAAC;AAED,iFAAiF;AACjF,SAAgB,aAAa,CAC3B,KAA2B,EAC3B,MAAc,EACd,OAA8C;IAE9C,OAAO,KAAK,CAAC,QAAQ;QACnB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG;QAAE,OAAO,OAAO,CAAA;IACzD,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,OAAO,SAAS,CAAA;AAClB,CAAC"}
|
package/dist/providers.d.ts
CHANGED
|
@@ -11,6 +11,11 @@
|
|
|
11
11
|
* new provider's *field layout* is a data change here, not new code in
|
|
12
12
|
* every place that touches credentials.
|
|
13
13
|
*
|
|
14
|
+
* AWS Bedrock, Google Vertex AI and Azure OpenAI are routed by the proxy's
|
|
15
|
+
* `src/cloud` module: requests name them as `bedrock/<model id>`,
|
|
16
|
+
* `vertex/<model>` and `azure/<deployment>`, and the stored blob is the
|
|
17
|
+
* region/endpoint plus credential that module signs or authenticates with.
|
|
18
|
+
*
|
|
14
19
|
* Deliberately NOT exhaustive — LiteLLM supports 100+ providers. This is a
|
|
15
20
|
* representative slice spanning the shapes that actually differ (single
|
|
16
21
|
* key, multi-field cloud credential, self-hosted endpoint, structured
|
|
@@ -19,13 +24,16 @@
|
|
|
19
24
|
* of these shapes is adding one entry, not new plumbing.
|
|
20
25
|
*
|
|
21
26
|
* `routingLive: true` means `packages/proxy` actually forwards requests to
|
|
22
|
-
* this provider today (`
|
|
23
|
-
*
|
|
24
|
-
*
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
27
|
+
* this provider today: it has an upstream for it (`provider_from_wire_id` in
|
|
28
|
+
* `proxy.rs`, which a proxy test holds this flag to). Gemini models are served
|
|
29
|
+
* on the Messages, Chat Completions and Responses routes, through the
|
|
30
|
+
* Gemini API translation; the proxy refuses the native `/v1beta/models/…`
|
|
31
|
+
* route, whose model is named in the URL. `routingLive: false` means the
|
|
32
|
+
* credential can be pre-provisioned here, but nothing in the proxy calls it
|
|
33
|
+
* yet — routing support is separate, real per-provider engineering (a new
|
|
34
|
+
* `Provider` enum variant, `get_model_provider`, pricing in `pricing.rs`),
|
|
35
|
+
* not a config change. The dashboard wizard must say so, not imply the key
|
|
36
|
+
* is live the moment it's saved.
|
|
29
37
|
*
|
|
30
38
|
* @module
|
|
31
39
|
*/
|
|
@@ -47,6 +55,15 @@ export interface ProviderDefinition {
|
|
|
47
55
|
/** Link to the provider's own API-key docs, shown in the wizard. */
|
|
48
56
|
docsUrl?: string;
|
|
49
57
|
fields: ProviderCredentialField[];
|
|
58
|
+
/**
|
|
59
|
+
* Alternative credential sets, at least one of which must be complete —
|
|
60
|
+
* e.g. Bedrock takes an access key pair OR a Bedrock API key. Each inner
|
|
61
|
+
* list names field keys that are required together. Fields named here
|
|
62
|
+
* are `required: false` individually.
|
|
63
|
+
*/
|
|
64
|
+
requiresOneOf?: string[][];
|
|
65
|
+
/** Shown above the fields: how requests name this provider's models. */
|
|
66
|
+
usageHint?: string;
|
|
50
67
|
/** See module doc — whether packages/proxy currently routes to this provider. */
|
|
51
68
|
routingLive: boolean;
|
|
52
69
|
}
|
|
@@ -93,11 +110,31 @@ export declare const DEEPSEEK_API_MODEL_IDS: readonly ["deepseek-chat", "deepsee
|
|
|
93
110
|
* against the Rust source; if the heuristic changes there, change it here in
|
|
94
111
|
* the same commit.
|
|
95
112
|
*
|
|
96
|
-
* Order matters and matches the Rust exactly:
|
|
97
|
-
* (
|
|
98
|
-
*
|
|
99
|
-
*
|
|
100
|
-
*
|
|
113
|
+
* Order matters and matches the Rust exactly: a cloud prefix
|
|
114
|
+
* ({@link cloudProviderForModel}) → claude → gemini → '/' (OpenRouter's
|
|
115
|
+
* vendor/model namespacing — checked before the mistral prefixes so
|
|
116
|
+
* "mistralai/..." routes to OpenRouter) → an exact DeepSeek API id
|
|
117
|
+
* ({@link DEEPSEEK_API_MODEL_IDS}) → mistral prefixes → OpenAI as the
|
|
118
|
+
* default arm. A `config.yaml` model alias is not visible here: it lives in
|
|
119
|
+
* the proxy's own configuration.
|
|
120
|
+
*/
|
|
121
|
+
export declare function inferProviderForModel(model: string): CloudProviderId | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'mistral' | 'openai';
|
|
122
|
+
/** Registry ids of the providers the proxy reaches through its cloud adapters. */
|
|
123
|
+
export type CloudProviderId = 'bedrock' | 'vertex_ai' | 'azure_openai';
|
|
124
|
+
/**
|
|
125
|
+
* The cloud provider a `bedrock/`, `vertex/` (or `vertex_ai/`) or `azure/`
|
|
126
|
+
* model name routes to — `crate::cloud::parse_prefixed` in the proxy.
|
|
127
|
+
*/
|
|
128
|
+
export declare function cloudProviderForModel(model: string): CloudProviderId | undefined;
|
|
129
|
+
/** Host suffixes a workspace's Azure endpoint may use — `AZURE_HOST_SUFFIXES` in the proxy. */
|
|
130
|
+
export declare const AZURE_ENDPOINT_HOST_SUFFIXES: readonly [".openai.azure.com", ".services.ai.azure.com", ".cognitiveservices.azure.com"];
|
|
131
|
+
/**
|
|
132
|
+
* The same checks the proxy applies when it reads a stored cloud credential
|
|
133
|
+
* (`cloud::config::from_workspace`), so a credential the proxy would refuse
|
|
134
|
+
* is refused when it is saved instead. Returns the reason, or `null`.
|
|
135
|
+
* Regions, locations and project ids become part of a hostname or URL path;
|
|
136
|
+
* the Azure endpoint is a host the gateway sends the key to, so it must be
|
|
137
|
+
* an Azure resource over TLS.
|
|
101
138
|
*/
|
|
102
|
-
export declare function
|
|
139
|
+
export declare function checkCloudCredentialFields(providerId: string, values: Record<string, string>): string | null;
|
|
103
140
|
//# sourceMappingURL=providers.d.ts.map
|
package/dist/providers.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAA;AAEhE,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,uBAAuB,EAAE,CAAA;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IAC1B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,4CAA6C,CAAA;AAEnF,eAAO,MAAM,iBAAiB,EAAE,kBAAkB,EA6GjD,CAAA;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,mEAAoE,CAAA;AAEvG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAEX,eAAe,GACf,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,UAAU,GACV,SAAS,GACT,QAAQ,CAYX;AAED,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;AAEtE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAchF;AAED,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B,0FAI/B,CAAA;AAIV;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAuC5G"}
|